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Memorandum 


To : SAC, BOSTON (264C-NEW) Date 2/11/92 


ree © ssa[_ kes 


UNSUBS (S) ; 


Subjects PLACEMENT OF MICHELANGELO 

VIRUS ON LEADING EDGE 

COMPUTERS; 

CPA; 

00: BOSTON 

On 2/1/92, I spoke ne LEADING EDGE 
COMPUTER COR telephone number 6~4800 regarding 
this matter. indicated that about 500 microcomputers had 


been infested at the LEADING EDGE facility in Compton, 
California, prior to shipping for retail sale throughout the 
United States. 


On 2/7/92, SSA 


Economic Crimes Unit, FBIHQ, indicated that this 
matter should be opened, with Boston as Office of Origin. 


Please coordinate interview ee i 
who holds an MS in Computer Science and will handle CF&A 


cases for USA, Boston. 
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Federal Bureau of Investigation 


Oifice af the Direetor Wushingran, D.C. 20538 


FBI Press Office Media Release 
(202) 324-3691 March 4, 1992 fe! 


STATEMENT BY FBI DIRECTOR SESSIONS CONCERNING. 
WHITE-COLLAR CRIME FRAUD ALERT ON COMPUTER VIRUSES 


FBI Director William S. Sessions made the following 
statement today regarding computer viruses and their potential 
impact on computer users. 


"A computer virus is a program that attaches itself to 
other programs and has the ability to replicate itself. 
Typically hidden, a virus can damage or destroy information 
stored in a computer. Presently, there are over 1,000 known 
computer virus strains in existence with new strains surfacing 
daily. 


ae Recent publicity regarding the 'Michelangelo Virus' has ; 
heightened the public's awareness of the existence of computer 
viruses and the potential damage they can cause. Viruses can 
exist in new commercial computer hardware, legitimate commercial 
software, and computer programs obtained by other means, such as 
electronic bulletin boards and disk swapping. The FBI urges 
computer operators to use appropriate security procedures to 
minimize the risk of a computer virus destroying information. 
Security procedures should include, at a minimum, routinely 
backing up sensitive or necessary data on a regular basis and, if 
Bossible, regularly scanning computer terminals for viruses using 
updated virus detecting software. If you detect a virus, consult 
a computer expert to obtain guidance on removing the virus from 
the infected equipment. 


The FBI investigates violations of a number of Federal 
statutes which can apply, if computerized data is intentionally 
altered, stolen or destroyed on networks, in financial | 
institutions, or in government computers. If you possess 
information indicating that Federal statutes concerning computer 
fraud and abuse may have been violated, please call your local | 
FBI field office." 
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, 5 
mpeau, the quintessential 80s man who tried to build a 
v of debt, emerged from hiding yesterday to watch 
y his dream. Shareholders and creditors approved a 
1ed-down property developer, Camdev Corp. 


ence ceeeaace Rabe aad Oe et ee a aie ek eg ee a Le ee ee 


Leading Edge 
attacked by 
rogue virus 
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By Josh Hyatt 
GLOBE STAFF 


‘Gaol 

Up until now, depending on your 
frame of reference, Michelangelo is ei- 
ther a famous artist or a member of the 
Ninja Turtles. As of today, though, he 
may become better known as a deadly 
computer virus, 

Leading Edye Products Inc, a 
Westborough cémputer maker, yester- 
day acknowledged that it had shipped 
500 computers infected with the so- 
called “Michelangelo” virus, a rogue 
program that will destroy any files it 
encounters on March 6, the painter and 
seulptor’s birthday. 

So far, the company says, it has 
reached about 80 percent of consumers 
who bought personal computers over 
the two-week span in December during 
which the virus was spread. For that 
f 


We don't know if they can be saved.’ 


CRAIG CONRAD, Leading Edge Products 


actment 


a 
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HELANGELO 
Can a virus be artful? 


group, the company can supply 4 sim- 
ple software antidote that halts the in- 
fection dead in its tracks. 

For those who don’t get the anti- 
dote in time, though, there isn’t much 
hope. “We don’t know if they can be 
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Who qualifies? 


If thé bill becomes law, people who are current- 
ly receiving extended jobless benefits or who will 
begin receiving those benefits between the bill’s en- 


al 18 weeks of benefits, 
People in high-unemployment states such ag ° 
Massachusetts would thus be eligible for a total of 
59 weeks of benefits: 26 weeks from the regular 
program, 20 additional weeks from the extension 
signed into law just before Thanksgiving and an 
additional 18 weeks from the new extension. 


and June 18 will be eligible for an addition- 


Fidelity fumes 
lose another 
top executive 


By Kimberly Blanton 
GLOBE STAFF 


A top-level Fidelity Investments ex- 
ecutive and a driving force in the firm's 
explosive growth is resigning to join Cred- 

it Suigse First Boston, an international in- 
vestment bark. 

John J. Cook Jr. will become chairman 
of First Boston Asset Management and 
Credit Suisse First Boston Investment 
Management. The Boston firms are in- 
vestment management units of Credit 
Suisse First Boston, based in New York. 

Cook’s resignation a3 president of Fi- 

| delity Investments Institutional Group, 
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Computer virus attacks Leading Edge 


@ VIRUS 
Continued from Page 65 

saved,” admitted Craig Con- 
rad, a company spokesman. Conrad 
further vowed to “find out how the 
virus got into our building.” 

But industry specialists gave the 
company long odds on actually pin- 
pointing the mean-spirited program- 
mer who planted it. “No virus writer 
has ever been collared to date,” not- 
ed John McAfee, president of a firm 
that specializes in detecting and re- 
moving computer viruses. “It’s a 
nearly impossible task. It’s like try- 
ing to trace the origins of the com- 
mon cold.” 

This virus doesn’t quite go back 
as far. But McAfee’s own research 

Feveals that Michelangelo was first 
identified last. Ma arch, and that it 
originated either in Sweden or The 
Netherlands. He : says it is one of 
1,100 or so viruses to which comput- 
ers are now susceptible. 

As with a biological virus, a com- 
puter virus is a self-replicating code 
that infects everything it touches. 
Typically, it spreads from one com- 
puter to another through the trans- 
fer of infected floppy diskettes. 

While each virus reflects the 
quirky agenda of its author, they al- 
most always do damage. Late last 


‘year, Novell Inc., a leading maker of 
networking equipment, discovered it 
had shipped products infected with a 
virus called “Stoned.” Before de- 
stroying files, that virus filled com- 
puter screens with a demand for the 
legalization of marijuana. 

Jn having a virus named after 
him, Michelangelo joins such former 
honorees as Father Christmas, 
Darth Vader, Frere Jacques and — of 
course — Saddam. 

Conrad said that Leading Edge 
notified dealers of the virus shortly 
after one of the company’s distribu- 
tors discovered it by accident in mid- 
December. That reseller was rou- 
tinely seanning the equipment with 
software that pinpoints viruses. 
After finding the Michelangelo code, 
the customer contacted the com- 
pany’s service department. 


Leading Edge then set about 
identifying the serial numbers of ma- 
chines that were sold with similar 
software attached. Conrad says the 
company determined that up to 500 
computers could be infected, and 
that the virus originated in equip- 
ment that was provided by a subcon- 
tractor to its assembly plant in 
Compton, Calif. Beyond that, Con- 
rad said, “we can’t get into too much 
detail.” 


The company notified dealers 
with a Jan. 10 letter, sending them 
diskettes that consumers can use to 
detect and remove the virus within 
two minutes. “They handled it pro- 
fessionally,” said Gordon Hoffstein, 


president of PC’s Compleat, a com- 


puter reseller in Marlborough. 


But not everyone praises the 
company’s behavior. “It’s astonish- 
ing that the internal quality control 
of some of the companies on which 
we rely is as loose as this,” declared — 
Richard tenEyck, who serves on the | 
board of the Boston Computer Soci- ° 
ety. “Their internal controls should 
be reviewed.” 

Indeed, Conrad said the com- 
pany will now take extra precau- 
tions, and may even begin bundling 
an antidote program with its com- 
puters. He pointed out that Michel- 
angelo only infected 10 percent of 
the computers Leading Edge 
shipped in December. 

Bur viruses of all kinds are on 
the upswing, one distributor said. 
“With the proliferation of modems 
and networks and all kinds of shared 
software, I’m suddenly seeing 
them,” said Peter Tedeschi, presi- 
dent of Computer Concepts, a retail 
outlet in Hanover. “ Until last year, I 
had never encountered one.” 


Pension pair face fraud, larceny charges 


WW QUIRK 
Continued from Page-65 


: amount of state 
and federal taxes withheld, while 
overreporting her own state and fed- 
eral withholdings by the same 
amount, Harshbarger said. 

The scheme, which involved false 
W-2s issued to nine employees in 
one year, and three in another, net- 
ted Quirk $6,500, according to state 
officials. 


ba 


. raigned Feb. 13 at Suffolk Superior 


Court. 

While Harshbarger spokesman 
Tom Samoluk said the charges re- 
sulted from an audit of the invest- 
ment board last spring, Cooley said 
the investigation was prompted by 
vindictive board members. 

“This was an operation run by 
the PRIM board to try to destroy 
[the Quirks], not because they are 
corrupt, but because they resisted 


$8 billion in pubic employee pension: 


money. 
At the time of his ouster, Quirk 
was under fire for accepting $25,000 
in cash and stock options from take- 
over specialist Carl Icahn to help 
mount a campaign against a com- 


pany that Icahn wanted to acquire., ° 


He also angered former Gov. Du- 
kakis by ringing up hefty travel ex- 
penses at a time when the rest of the 


sos . . | 
administration was taking across- 


dom,ana aise’ iace 
trying to expand. 
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i 
FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 3/12/92 


Product Development, LEADING 
EDGE PRODUCTS, INCORPORATED (LE), Westborough, Massachusetts, was 
interviewed with the assistance of[ | assistant 


United States Attorne, District of Massachusetts. [_]furnished bé 

the following information: bie 
On January 7, 1992, one of LE! tomers, L.D.I., 

located in Cleveland, Ohio, reported to that the Michel- 


Angelo virus had been detected in a computer shipped directly 
from LE, 150 Carob Street, Compton, California. 


Subsequent investigation by LE in Compton, California, 
discovered three diskettes in one box, and three diskettes in 
another, all infected with the Michel Agelo virus and awaiting 
shipment from the LE, Compton warehouse. The diskettes were 
received between December 7-21, 1991, from ZENIX, Erie Street, 
a, California. Three of the diskettes were forwarded to 
[is Massachusetts. Two of the diskettes were cleaned and ate 
estroyed in the LE, Westborough, Massachusetts facility. one Bic 
diskette was sent back to ZENIX. [els Compton, Cali- 
fornia, discovered the six infected diskettes and retained three 


under lock and key. Three diskettes were shipped to LE, in 
Massachusetts. 


Date dictated 3/5/92 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned 
to your agency; it and its contents are not to be distributed outside your agency. 
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GUBJECT: UNSUB(S); PLACEMENT OF MICHELANGELLO VIRUS ON LEADING 

po (LE) COMPUTERS; CFA; 00: BOSTON. 

5» | ON 3/4/92, CONTACT, WAS MADEWiTHT ° eo, 
qeROYUCE DEVELOPMENT, LE PRODUCTS, INC., WESTBOROUGH, MA. [ 

g{DV{SED A CLEVELAND, OHIO, LE CUSTOMER DISCOVERED ON 1/7/92 THE 

MICHELANGELLO VIRUS IN A PRODUCT RECEIVED DIRECTLY FROM LE, 

a SOPIONs CA. y, | 
SUBSEQUENT INVESTIGATION BY LE IN COMPTON, CA, DISCOVERED 


44 
THREE DISKETTES IN ONE BOX AND THREE DISKETTES IN ANOTHER. ALL 
18 
WERE INFECTED WITH THE MICHELANGELLO VIRUS AND AWAITING SHIPMENT 
16 
17 
18 
1 
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FROM] THE COMPTON WAREHOUSE. LE DETERMINED THE DISKETTES WERE 
“ RgcHVED BETWEEN 12/7-21/91 FROM XENIX, ERIE STREET, POMONA, CA, 
* GBIHPHONE NUMBER “(714) 629-8050. “THREE DISKETTES WERE FORWARDED 
Tp Phen MASSACHUSETTS. TWO OF THESE WERE CLEANED AND 
RES FROVED IN THE MASSACHUSETTS FACILITY: ONE WAS SENT BACK TO 
XENAK. Cf, COMPTON, CA, DISCOVERED THE SIX INFECTED 
DISYS AND HAS RETAINED THE REMAINING THREE DISKETTES UNDER LOCK 


AND JKEY IN HIS DESK IN CA. [_ | WILL BE AVAILABLE 3/9/92. 


ausal DISTRICT OF MASSACHUSETTS , ADVISED HE 


oo ENTERTAIN PROSECUTION SHOULD VENUE AND VIOLATION OF CFA 


STATUTE BE ESTABLISHED. 
a1 


12 


LEADS: 
LA AT COMPTON, CAs: 


73 
conractt 150 CAROB STREET, COMPTON, CA, AND OBTAIN 


14 
THH THREE DISKETTES CONTAINING THE MICHELANGELLO ‘VIRUS AND 


‘FS ofWARD TO BOSTON DIVISION. IT IS NOTED LE IS SUBSIDIARY OF 

+6 GhoMATION SOURCES AS LOCATED AT SAME ADDRESS, AND PRIOR TO 

Y coftracr wirs| | IT IS RECOMMENDED THAT[s—“‘sCid' 
V8] FIRST BE CONTACTED. | 

19 LA AT POMONA, CA: 

26 

21 
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q | CONTACT ——a XENIX, ERIE STREET, 
b7c 


" ‘Bend A, CA, TELEPHONE (714) 629-8050 AND DETERMINE WHERE- AND WHEN 
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IgiCHELANGELLO VIRUS DETERMINED BY XENIX. 
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a) 
Memorandum 
To : SAC, BOSTON (264C-BS-62095) (C) Dae 4/9/92 
From : $A ROBERT A. KEANE (C-5) 
Subject: UNSUBS; 


PLACEMENT OF MICHELANGELO VIRUS 
ON LEADING EDGE COMPUTERS; 

CFA; 

00: BOSTON 


Re FD-302 with[| ———————_—sdds 3/4/92, at Westborough, 


Massachusetts. 


Investigation in this matter was initiated with the 
report of a local Westborough, Massachusetts company that 
indicated the company shipped 500 computers infected with the 
"MICHELANGELO" virus. 


Contact was made with AUSA District of 
Massachusetts, who advised he would entertain Federal prosecution 
should Federal jurisdiction and venue be established in the State 
of Massachusetts. 


Investigation at LEADING EDGE computer company, 
Westborough, Massachusetts, revealed no evidence of a Federal 
violation. 


This matter was kept pending throughout March 1992, in 
the event a report indicating a violation of a Federal statute 
occurred, particularly over 3/6/92, the anniversary of 
MICHELANGELO’s birthday. Apparently, the extensive publicity 
given by the media stimulated individuals and companies to 
institute, safeguards to prevent damage by the "MICHELANGELO" 
virus, @s@ damage was not as extensive as originally anticipated. 


To date, there has been no report of computer abuse 
meeting Federal statutory requirements, and it is recommended 
this matter receive no further investigation and be closed 
administratively. 
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